AI uncovers critical PHP flaws, prompting global website shutdowns and emergency patches

AI-driven analysis uncovered two critical remote-code-execution flaws in PHP, the scripting language behind about 70 % of the internet. The bugs were first identified by security firm Calif using OpenAI’s GPT-5.6 Sol and later. After confidential reporting, PHP maintainers issued a patch on Oct 21.

On Oct 22, the US National Security Agency, together with authorities in Japan, the European Union and China’s Ministry of Industry and Information Technology, urged organisations to apply the fix immediately or take vulnerable sites offline, leading to widespread shutdowns of government portals, insurance services, transport operators and even a popular app. Experts such as Rahat Masood and Volker Dusch warned the vulnerabilities could let attackers access servers without usernames or passwords, likening the risk to the 2014 Heartbleed bug. While large platforms could update swiftly, smaller sites may stay exposed for weeks, raising concerns about data breaches and subsequent phishing attacks.